# Why Phishing Scanners Disagree

> A concise, page-specific guide to PhishDestroy's research on conflicting phishing verdicts, scanner timestamps, redirects, cloaking, and evidence scope.

- Canonical article: https://phishdestroy.io/why-phishing-scanners-disagree
- Extended LLM context: https://phishdestroy.io/llms-full.txt
- Author and publisher: PhishDestroy Research
- Published: 2026-08-04
- Language: en-US
- Content type: independent threat-intelligence methodology guide

## Core Insights

Phishing scanners disagree because they are not repeating one identical test. Each service has its own input URL, collection time, browser environment, data suppliers, detection thresholds, and vocabulary.

1. **Different Clocks:** Phishing pages appear and vanish rapidly. One scanner captures the live campaign; another queries the host after it redirects to a parking page; a third updates hours later from partner feeds. Stored timestamped evidence is necessary.
2. **Different Objects:** A URL, hostname, and registered domain are distinct scopes. A scanner may inspect a domain but miss a deep path-specific threat or a user-created subdomain.
3. **Cloaking & Delivery:** Malicious servers can vary responses based on geography, referrer, user agent, IP reputation, or cookies. An automated scanner may receive a decoy while real victims are redirected to a drainer.

## Practical workflow for conflicting verdicts

1. Normalize the target (URL, hostname, registrable domain, final URL).
2. Freeze the collection time in UTC for every observation.
3. Preserve direct forensic evidence (screenshot, DOM, response).
4. Separate direct observation from downstream inference.
5. Cross-check independent evidence layers.